TL;DR Either disable Windows Firewall entirely, or allow ICMP Time Exceeded packets through WF.
I have a more detailed and thorough article on my blog.
This is the answer:
If your Windows Firewall in turned on on your host, you will see this behavior - only the first and last device answers. If it's turned off, it works (at least for me).
The detailed reason is,
traceroute works by sending ICMP Echo Requests with increasing TTL starting from 1, so when they "die of time", the intermediate routers send back ICMP Time Exceeded packets, which is unexpected by Windows Firewall.
The obvious solution is to turn off Windows Firewall entirely, but that's probably not safe for some users.
The solution without turning off Windows Firewall is to explicitly allow ICMP Time Exceeded (ICMPv4 Type 11 / ICMPv6 Type 3) to come in. This can be done as follows:
Open Windows Firewall: Start → Windows Administrative Tools → Windows Defender Firewall with Advanced Security (yeah the name is verbose)
Select Inbound Rules on the left
Select New Rule... on the right
Follow the prompt. Select the following options in order:
- Rule Type: Custom
- Program: All programs (just click Next)
- Protocol and Ports:
- Protocol type: ICMPv4
- (Optional) Internet Control Message Protocol (ICMP) settings: Click Customize → Select Specific ICMP types and tick Time Exceeded
- Scope: Any IP address for both (just click Next)
- Action: Allow (just click Next)
- Profile: Select all (just click Next)
- Name: Core Networking - Time Exceeded (ICMPv4-In) (apparently just any name you prefer)
Click Finish and you should immediately see intermediate hops if you're using
mtr (My Traceroute).
(Optional) Repeat the above steps but select ICMPv6 for Protocol type if you want to enable IPv6 traceroute.